ARCHIVE/xahaud
3
0
Fork 0
mirror of https://github.com/Xahau/xahaud.git synced 2026-07-28 09:30:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(export): simplify submitter co-signer model

Browse Source
This commit is contained in:
Nicholas Dudfield
2026-07-10 16:24:35 +07:00
parent 75d08560d4
commit 5e2cbf62fe
2 changed files with 17 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/xrpld/app/consensus/ConsensusExtensionsDesign.md
View File

@@ -455,16 +455,15 @@ static destination SignerList should remain anchored to the original source
universe during NegativeUNL periods, trading Export liveness for unchanged
destination authority.
A hardened deployment may add a separate mandatory executor signer to the
destination SignerList. Choose weights so destination quorum requires both the
source-validator threshold and the executor; for validator weight total `V` and
required validator weight `q`, executor weight `V` with target quorum `V + q`
is the simple construction. Proposal-carried validator shares then remain inert
until the executor observes a validated source latch and signs. The executor
cannot authorize alone but becomes a liveness and censorship dependency. It
consumes one destination SignerList entry, so this profile supports at most 31
source validator identities under a 32-entry limit, and it does not solve XPOP
replay after target execution.
A hardened deployment may add a required submitter co-signer to the destination
SignerList, held by the target-submission process. Choose weights so destination
quorum requires both the source-validator threshold and that key; for validator
weight total `V` and required validator weight `q`, submitter weight `V` with
target quorum `V + q` is the simple construction. Proposal-carried validator
shares then remain inert until the submitter observes a validated source latch
and signs. The key cannot authorize alone but becomes a liveness and censorship
dependency. It consumes one destination SignerList entry, so this profile
supports at most 31 source validator identities under a 32-entry limit.
The extended proposal machinery is enabled when either feature needs signed
sidecar fields. Do not make Export depend on RNG availability just because RNG

17
src/xrpld/app/consensus/ExportIntent.md
View File

@@ -145,15 +145,14 @@ SignerList is static, configure it against the original pre-NegativeUNL source
universe and accept reduced Export liveness during NegativeUNL periods rather
than lowering destination authority.
An optional stronger deployment profile adds a separate mandatory executor
signer. If validator weights total `V`, validator threshold is `q`, executor
weight is `C`, and target quorum is `C + q > V`, validator shares alone cannot
execute and the executor still needs validator weight `q`. The executor signs
only after observing the validated source latch. This converts the executor into
a liveness/censorship dependency, not a sole safety authority, and does not
replace callback replay protection after target execution. A separate executor
also consumes one target SignerList entry, leaving at most 31 source validator
identities under a 32-entry destination limit.
An optional stronger deployment profile adds a required submitter co-signer held
by the target-submission process. If validator weights total `V`, validator
threshold is `q`, submitter weight is `C`, and target quorum is `C + q > V`,
validator shares alone cannot execute and the submitter still needs validator
weight `q`. It signs only after observing the validated source latch, turning
the submitter into a liveness/censorship dependency rather than a sole safety
authority. The separate key consumes one target SignerList entry, leaving at
most 31 source validator identities under a 32-entry destination limit.
## Replay Witness Shape